Lucene search
+L

64320 matches found

Fedora
Fedora
added 2026/07/07 1:11 a.m.12 views

[SECURITY] Fedora 43 Update: kernel-headers-7.1.3-100.fc43

Kernel-headers includes the C header files that specify the interface between the Linux kernel and userspace libraries and programs. The header files define structures and constants that are needed for building most standard programs and are also needed for rebuilding the glibc package...

8.8CVSS6.2AI score0.0012EPSS
SaveExploits5
Fedora
Fedora
added 2026/07/07 1:10 a.m.11 views

[SECURITY] Fedora 43 Update: podman-tui-1.11.3-1.fc43

podman-tui is a terminal user interface for Podman. podman-tui is using podman.socket service to communicate with podman environm ent and SSH to connect to remote podman machines...

9.1CVSS6.9AI score0.00651EPSS
SaveExploits1
Snyk
Snyk
added 2026/07/07 12:33 a.m.5 views

Improper Restriction of Rendered UI Layers or Frames

Overview ajenti is a Linux & BSD web admin panel. Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames through the lack of anti-framing protections in the HTTP response process. An attacker can trick users into interacting with a maliciously...

5.4CVSS6AI score0.00159EPSS
SaveExploits0References2
NOZOMI
NOZOMI
added 2026/07/07 12:0 a.m.5 views

Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0

Summary A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. Impact An unauthenticated attacker can send a request to the SSH keys synchronization endpoint and obtain the list of users that have uploaded their public SSH keys, their groups, and the...

6.9CVSS6AI score0.00235EPSS
SaveExploits0Affected Software2
Positive Technologies
Positive Technologies
added 2026/07/07 12:0 a.m.8 views

PT-2026-56268

Name of the Vulnerable Software and Affected Versions mem0 affected versions not specified Description Unauthenticated config API endpoints expose LLM API keys in plaintext and enable server-side request forgery SSRF, a technique where an attacker induces the server to make requests to an...

9.3CVSS6.1AI score0.00259EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/07/07 12:0 a.m.17 views

PT-2026-56272

Name of the Vulnerable Software and Affected Versions DBI versions prior to 1.650 Description Code injection is possible via a caller-influenced Profile attribute. When a string is assigned to this attribute, the software splits it into path, package, and arguments, then interpolates the package...

8.8CVSS6.6AI score0.00498EPSS
SaveExploits0References32
Positive Technologies
Positive Technologies
added 2026/07/07 12:0 a.m.14 views

PT-2026-56273

Name of the Vulnerable Software and Affected Versions DBI versions prior to 1.650 Description A heap overflow occurs when preparsing SQL statements that contain an extreme number of placeholders. This happens because insufficient memory was allocated to handle approximately 1.2 million...

9.8CVSS6.2AI score0.00396EPSS
SaveExploits0References15
Positive Technologies
Positive Technologies
added 2026/07/07 12:0 a.m.9 views

PT-2026-56244

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.24 Description The /de2api/share/proxyInfo share interface generates and returns an X-DE-LINK-TOKEN before validating the share password or ticket. This allows unauthenticated attackers who possess a protected...

8.7CVSS6.1AI score0.00285EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/07/07 12:0 a.m.9 views

PT-2026-56193

Name of the Vulnerable Software and Affected Versions Digi PortServer TS affected versions not specified Digi One SP affected versions not specified Digi One SP IA affected versions not specified Digi One IA affected versions not specified Description A stored cross-site scripting XSS issue exist...

4.8CVSS6.1AI score0.00269EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/07/07 12:0 a.m.5 views

CVE-2026-36162

An authenticated stored cross-site scripting XSS vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 allows attackers to execute arbitrary Javascript or HTML via injecting a crafted payload into the Name parameter...

6AI score0.00141EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/07 12:0 a.m.4 views

ALSA-2026:36364 Important: nginx security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes...

9.2CVSS7.4AI score0.03552EPSS
SaveExploits1References4
OSV
OSV
added 2026/07/07 12:0 a.m.5 views

ALSA-2026:36331 Important: nginx security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes...

9.2CVSS7.4AI score0.03552EPSS
SaveExploits1References4
OSV
OSV
added 2026/07/07 12:0 a.m.5 views

ALSA-2026:36307 Moderate: freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface IPMI remote console and system management software based on the IPMI specification. Security Fixes: freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client CVE-2026-50031 For more details about the...

7.5CVSS6.2AI score0.00405EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/07 12:0 a.m.4 views

ALSA-2026:36211 Moderate: freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface IPMI remote console and system management software based on the IPMI specification. Security Fixes: freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client CVE-2026-50031 For more details about the...

7.5CVSS6.2AI score0.00405EPSS
SaveExploits0References4
NVD
NVD
added 2026/07/06 11:16 p.m.14 views

CVE-2026-53645

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged staff account to grant arbitrary module permissions to itself through the admin API, resulting in persistent privilege escalation. A staff user that only has...

8.5CVSS0.0024EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/06 10:55 p.m.20 views

CVE-2026-53645

CVE-2026-53645 affects FOSSBilling prior to 0.8.0. A low-privileged staff member with staff.create_and_edit_staff can call /api/admin/staff/permissions_update to modify their own permissions, bypassing RBAC and enabling persistent privilege escalation. Version 0.8.0 patches the issue. Workarounds...

8.5CVSS6AI score0.0024EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/06 10:49 p.m.9 views

CVE-2026-53643

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized actions via admin API endpoints. The root cause is a combination of the canalwaysaccess module flag which grants all staff access to certain...

8.7CVSS6AI score0.00226EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/07/06 10:49 p.m.4 views

CVE-2026-53643 FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized actions via admin API endpoints. The root cause is a combination of the canalwaysaccess module flag which grants all staff access to certain...

8.7CVSS6AI score0.00226EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/06 9:52 p.m.9 views

GHSA-QRWJ-VH9X-GW5V Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write

Summary agentConn.apiClient used the default redirect behavior of http.Client while its custom transport dialed the host from the request URL as long as the port was the workspace agent HTTP API port 4. Agent tailnet IPs are deterministic from agent UUIDs, so a malicious workspace agent could...

8.3CVSS6.2AI score
SaveExploits0References3
NVD
NVD
added 2026/07/06 9:16 p.m.12 views

CVE-2026-57572

Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browserconfig.extraargs, which flowed into Chromium's launch arguments. An attacker could inject Chromium switches that replace a child-process launch command together...

10CVSS0.00523EPSS
SaveExploits0References2
Rows per page
Query Builder